Auburn National Bancorporation (AUBN) Risk Analysis

realizable for income tax purposes may be reduced under Section 382 of the Internal Revenue Code by sales of our capital

Liquidity risks could affect operations and jeopardize our financial condition. The COVID-19 pandemic generally has increased our deposits and at banks, generally, while reducing the interest rates earned on loans and securities. Such excess liquidity and the resulting balance sheet growth requires capital support and reduced returns on assets and equity. Inflation and tightening monetary policies beginning in early 2022 have increased interest spreads, but may change the mix and costs of our deposits over time. The growth in deposits exceeded our loan growth and the difference was invested in high-quality, marketable U.S. government and government agency securities,including agency mortgage-backed securities. Liquidity is essential to our business. An inability to raise funds through deposits, borrowings, proceeds from loan repayments or sales proceeds from maturing loans and securities, and other sources could have a negative effect on our liquidity. Our funding sources include deposits (primarily core deposits), federal funds purchased, securities sold under repurchase agreements, and short- and long-term debt. We maintain a portfolio of marketable high-quality securities that can be used as a source of liquidity. As market interest rates have risen, however, we have experienced unrealized losses on such securities, which would become realized losses upon the sale of such securities, and such sales at a loss would reduce our net income and our regulatory capital. We are also members of the FHLB and the Federal Reserve Bank, and we can obtain advances collateralized with eligible assets, and maintain uncommitted federal funds lines of credit with other banks. On March 12, 2023, the Federal Reserve established a new Bank Term Funding Program ("BTFP"), which offers loans of up to one year to banks, savings associations, credit unions, and other eligible depository institutions pledging U.S. Treasuries, agency debt and mortgage-backed securities, and other qualifying assets as collateral. These assets will be valued at par. The BTFP will be an additional source of liquidity against high-quality securities, eliminating an institution's need to quickly sell those securities in times of stress. In addition, the discount window will apply the same margins used for the securities eligible for the BTFP, further increasing the value of investment securities at the discount window. Other sources of liquidity available to the Company or the Bank, if needed, include our ability to acquire additional non-core deposits. We may be able, depending upon market conditions, to otherwise borrow money or issue and sell debt and preferred or common securities in public or private transactions. Our access to funding sources in amounts adequate to finance or capitalize our activities on terms which are acceptable to us could be impaired by factors that affect us specifically, or the financial services industry, the economy and market interest rates and fiscal and monetary policies. General conditions that are not specific to us, such as disruptions in the financial markets or negative views and expectations about the prospects for the financial services industry could adversely affect us.

Our enterprise risk management and internal audit program is designed to mitigate material risks and loss to us. We have developed and continue to develop risk management and internal audit policies and procedures to reflect the ongoing review of our risks and expect to continue to do so in the future. Nonetheless, our policies and procedures may not be comprehensive and may not identify timely every risk to which we are exposed, and our internal audit process may fail to detect such weaknesses or deficiencies timely in our risk management framework. Many of our risk management models and estimates use observed historical market behavior to model or project potential future exposure. Models used by our business, including the new CECL models, are based on assumptions and projections. These models may not operate properly or our inputs and assumptions may be inaccurate, or changes in economic and market conditions, customer behaviors or regulations. As a result, these methods may not fully or timely predict future exposures, which can be significantly greater and/or faster than historically. Other risk management methods depend upon the evaluation of information regarding markets, clients, or other matters that are publicly available or otherwise accessible to us. This information may not always be accurate, complete, up-to-date or properly evaluated. Furthermore, there can be no assurance that we can effectively review and monitor all risks or that all of our employees will closely follow our risk management policies and procedures, nor can there be any assurance that our risk management policies and procedures will enable us to accurately identify all risks and limit our exposures based on our assessments. In addition, we may have to implement more extensive and perhaps different risk management policies and procedures as our regulation changes. For example, the Federal Reserve and the OCC are in the initial stages of proposing climate risk management criteria and potential climate risk stress tests. The SEC is expected to require more disclosure on climate risks, also. All of these could adversely affect our financial condition and results of operations.

We face risks of litigation and regulatory investigations and actions in the ordinary course of operating our businesses,including the risk of class action lawsuits. Plaintiffs in class action and other lawsuits against us may seek very large and/or indeterminate amounts, including punitive and treble damages. Due to the vagaries of litigation, the ultimate outcome of litigation and the amount or range of potential loss at particular points in time may be difficult to ascertain. We do not have any material pending litigation or regulatory matters affecting us.

Our information systems may experience interruptions and security breaches. We rely heavily on communications and information systems, including those provided by third-party service providers, to conduct our business. Any failure, interruption, or security breach of these systems could result in failures or disruptions which could affect our customers' privacy and our customer relationships, generally. Our business continuity plans,including those of our service providers, for back-up and service restoration, may not be effective in the case of widespread outages due to severe weather, natural disasters, pandemics, or power, communications and other failures. Our systems and networks, as well as those of our third-party service providers, are subject to security risks and could be susceptible to disruption through cyber-attacks, such as denial of service attacks, hacking, terrorist activities, or identity theft. Cybercrime risks have increased as electronic and mobile banking activities increased as a result of the COVID-19 pandemic, and may increase as a result of the Russia invasion of Ukraine and tensions with mainland China. Other financial service institutions and their service providers have reported material security breaches in their websites or other systems, some of which have involved sophisticated and targeted attacks, including use of stolen access credentials,malware, ransomware, phishing and distributed denial-of-service attacks, among other means. Such cyber-attacks may also seek to disrupt the operations of public companies or their business partners, effect unauthorized fund transfers, obtain unauthorized access to confidential information, destroy data, disable or degrade service, or sabotage systems. Hacking and identity theft risks, in particular, could cause serious reputational harm. Despite our cybersecurity policies and procedures and our Board of Director's and Management's efforts to monitor and ensure the integrity of the systems we use, we may not be able to anticipate the rapidly evolving security threats, nor may we be able to implement preventive measures effective against all such threats. The techniques used by cyber criminals change frequently, may not be recognized until launched and can originate from a wide variety of sources, including external service providers, organized crime affiliates, terrorist organizations or hostile foreign governments. These risks may increase in the future as the use of mobile banking and other internet electronic banking continues to grow. Security breaches or failures may have serious adverse financial and other consequences, including significant legal and remediation costs, disruptions to operations, misappropriation of confidential information, damage to systems operated by us or our third-party service providers, as well as damages to our customers and our counterparties. In addition, these events could damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny, or expose us to civil litigation and possible financial liability, any of which could have a material adverse effect on our financial condition and results of operations.

The financial services industry is undergoing rapid technological changes with frequent introductions of new technology driven products and services and growing demands for mobile and user-based banking applications. In addition to allowing us to analyze our customers better, the effective use of technology may increase efficiency and may enable financial institutions to reduce costs, risks associated with fraud and compliance with anti-money laundering and other laws, and various operational risks. Largely unregulated "fintech" businesses have increased their participation in the lending and payments businesses, and have increased competition in these businesses. Our future success will depend, in part, upon our ability to use technology to provide products and services that meet our customers' preferences and create additional efficiencies in operations, while avoiding cyber-attacks and disruptions, data breaches and anti-money laundering and other potential violations of law. The COVID-19 pandemic and increased remote work has accelerated electronic banking activity and the need for increased operational efficiencies. We may need to make significant additional capital investments in technology, including cyber and data security, and we may not be able to effectively implement new technology-driven products and services, or such technology may prove less effective than anticipated. Many larger competitors have substantially greater resources to invest in technological improvements and, increasingly, non-banking firms are using technology to compete with traditional lenders for loans, payments, and other banking services. As a result,our competition from service providers not located in our markets has increased.

Operational risks are inherent in our businesses. Operational risks and losses can result from internal and external fraud; gaps or weaknesses in our risk management or internal audit procedures; errors by employees or third parties, including our vendors, failures to document transactions properly or obtain proper authorizations; failure to comply with applicable regulatory requirements in the various jurisdictions where we do business or have customers; failures in our estimates models that rely on; equipment failures,including those caused by natural disasters, or by electrical, telecommunications or other essential utility outages; business continuity and data security system failures, including those caused by computer viruses, cyberattacks, unforeseen problems encountered while implementing major new computer systems or, failures to timely and properly upgrade and patch existing systems or inadequate access to data or poor response capabilities in light of such business continuity and data security system failures; or the inadequacy or failure of systems and controls, including those of our vendors or counterparties. The COVID-19 pandemic presented operational challenges to maintaining continuity of operations of customer services while protecting our employees' and customers' safety and similar situations may occur in the future. In addition, we face certain risks inherent in the ownership and operation of our bank premises and other real-estate, including liability for accidents on our properties. Although we have implemented risk controls and loss mitigation actions, and substantial resources are devoted to developing efficient procedures, identifying and rectifying weaknesses in existing procedures and training staff and potential environmental risks, it is not possible to be certain that such actions have been or will be effective in controlling these various operational risks that evolve continuously.